---
title: "Rotate company webhook signing secret"
method: POST
path: "/companies/{id}/webhooks/{webhook_id}/rotate-secret"
tags: ["Companies"]
---

# Rotate company webhook signing secret

`POST /companies/{id}/webhooks/{webhook_id}/rotate-secret`

## Request

- Base URL: `https://api.100hires.com/v2`
- URL: `https://api.100hires.com/v2/companies/{id}/webhooks/{webhook_id}/rotate-secret`
- Auth: HTTP bearer

Rotates the webhook's signing secret with zero downtime. The previous secret remains valid for a grace window so both old and new `x-hires-signature-v2` signatures are accepted while you switch over.

## Path parameters

- `id` integer, required
- `webhook_id` integer, required

## Response `200`

New signing secret (the previous one stays valid for a grace window).

- WebhookWithSecret
  - `id` integer: Unique identifier
  - `url` string: Endpoint URL that receives webhook event payloads
  - `signing_secret` string: HMAC-SHA256 signing secret for this webhook, used to verify the `x-hires-signature-v2` header. Returned ONLY in create and rotate-secret responses — store it securely, it is never shown again.

## Other responses

- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not found
- `429`: Too many requests

---

[API](https://skmtc.dev/100hires/apis/100hires-api.md) · [All operations](https://skmtc.dev/100hires/apis/100hires-api/llms.txt) · [OpenAPI document](https://skmtc.dev/100hires/apis/100hires-api/revisions/e63e2d3115f7?raw)